CVE-2025-31698 - Apache Traffic Server PROXY Protocol ACL IP Address Use Vulnerability
CVE ID : CVE-2025-31698
Published : June 19, 2025, 10:15 a.m. | 19 minutes ago
Description : ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol.
Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol.
This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 10:15:00 GMT
read more
CVE-2025-49763 - Apache Traffic Server ESI Plugin Remote Memory Consumption Vulnerability
CVE ID : CVE-2025-49763
Published : June 19, 2025, 10:15 a.m. | 19 minutes ago
Description : ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.
Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.
This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.
Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 10:15:00 GMT
read more
CVE-2025-5071 - WordPress AI Engine Plugin Unauthenticated Privilege Escalation and Data Deletion Vulnerability
CVE ID : CVE-2025-5071
Published : June 19, 2025, 10:15 a.m. | 19 minutes ago
Description : The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 10:15:00 GMT
read more
CVE-2025-5234 - WordPress Gutenverse News Plugin Stored Cross-Site Scripting Vulnerability
CVE ID : CVE-2025-5234
Published : June 19, 2025, 10:15 a.m. | 19 minutes ago
Description : The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 10:15:00 GMT
read more
CVE-2016-3399 - "CVE-2022-1234: Apache HTTP Server Unauthenticated Remote Code Execution"
CVE ID : CVE-2016-3399
Published : June 19, 2025, 9:15 a.m. | 1 hour, 19 minutes ago
Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 09:15:00 GMT
read more
CVE-2025-4571 - GiveWP - Donation Plugin and Fundraising Platform Unauthenticated Data Disclosure and Modification Vulnerability
CVE ID : CVE-2025-4571
Published : June 19, 2025, 7:15 a.m. | 3 hours, 19 minutes ago
Description : The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 07:15:00 GMT
read more
CVE-2025-4965 - WordPress WPBakery Page Builder Stored Cross-Site Scripting Vulnerability
CVE ID : CVE-2025-4965
Published : June 19, 2025, 7:15 a.m. | 3 hours, 19 minutes ago
Description : The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 07:15:00 GMT
read more
CVE-2025-5490 - WordPress Football Pool Stored Cross-Site Scripting Vulnerability
CVE ID : CVE-2025-5490
Published : June 19, 2025, 6:15 a.m. | 4 hours, 19 minutes ago
Description : The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 06:15:00 GMT
read more
CVE-2025-5524 - OceanWP WordPress Stored Cross-Site Scripting Vulnerability
CVE ID : CVE-2025-5524
Published : June 19, 2025, 5:15 a.m. | 5 hours, 19 minutes ago
Description : The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 05:15:00 GMT
read more
CVE-2025-4367 - WordPress Download Manager Stored Cross-Site Scripting Vulnerability
CVE ID : CVE-2025-4367
Published : June 19, 2025, 4:15 a.m. | 6 hours, 19 minutes ago
Description : The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 04:15:00 GMT
read more
CVE-2025-4479 - ElementsKit Elementor Addons and Templates WordPress Stored Cross-Site Scripting
CVE ID : CVE-2025-4479
Published : June 19, 2025, 4:15 a.m. | 6 hours, 19 minutes ago
Description : The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 04:15:00 GMT
read more
CVE-2025-50201 - WeGIA Web Manager OS Command Injection Vulnerability
CVE ID : CVE-2025-50201
Published : June 19, 2025, 4:15 a.m. | 6 hours, 19 minutes ago
Description : WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 04:15:00 GMT
read more
CVE-2025-52474 - WeGIA Web Manager SQL Injection Vulnerability
CVE ID : CVE-2025-52474
Published : June 19, 2025, 4:15 a.m. | 6 hours, 19 minutes ago
Description : WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. This issue has been patched in version 3.4.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 04:15:00 GMT
read more
CVE-2025-4661 - Brocade Fabric OS Path Transversal Privilege Escalation Vulnerability
CVE ID : CVE-2025-4661
Published : June 19, 2025, 3:15 a.m. | 7 hours, 19 minutes ago
Description : A path transversal vulnerability in
Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to
gain access to files outside the intended directory potentially leading
to the disclosure of sensitive information.
Note: Admin level privilege is required on the switch in order to exploit
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Thu, 19 Jun 2025 03:15:00 GMT
read more
CVE-2025-50183 - OpenList Frontend Stored XSS Vulnerability
CVE ID : CVE-2025-50183
Published : June 19, 2025, 3:15 a.m. | 7 hours, 19 minutes ago
Description : OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in